deploy.yml

name: Deploy

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Check for required secrets
        run: |
          if [ -z "${{ secrets.AWS_ACCOUNT_ID }}" ]; then
            echo "Error: AWS_ACCOUNT_ID secret is not set."
            exit 1
          fi
          if [ -z "${{ secrets.AWS_REGION }}" ]; then
            echo "Error: AWS_REGION secret is not set."
            exit 1
          fi

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/GithubActionsCamplyRole
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Install dependencies
        run: |
          npm ci
          cd lambda && pip install -r requirements.txt -t .

      - name: Run tests
        run: npm test

      - name: Build CDK app
        run: npm run build

      - name: Deploy to AWS
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: npx cdk deploy --require-approval never